Cloud providers
What KubeHero does per cloud on AKS, GKE and EKS — node pricing, zones, node pools, spot, network rates — and what it doesn't need from your cloud account.
KubeHero works from inside the cluster. It doesn't need credentials to your cloud accounts to attribute cost, collect logs, profile or map the network: everything it needs comes from the Kubernetes API, the nodes, and public price lists.
What is detected from the cluster
| How | |
|---|---|
| Cloud | the node's spec.providerID prefix (aws://, gce://, azure://), falling back to labels |
| Region, zone | topology.kubernetes.io/region, topology.kubernetes.io/zone |
| Instance type | node.kubernetes.io/instance-type (or the legacy beta. label) |
| Node pool | eks.amazonaws.com/nodegroup (EKS), cloud.google.com/gke-nodepool (GKE), agentpool / kubernetes.azure.com/agentpool (AKS), or chargeback.nodepoolLabel |
| Lifecycle | eks.amazonaws.com/capacityType, karpenter.sh/capacity-type, cloud.google.com/gke-spot / gke-preemptible, kubernetes.azure.com/scalesetpriority → on-demand · spot · reserved; override with the kubehero.io/lifecycle node label (e.g. savings-plan, committed) |
| GPUs | nvidia.com/gpu and amd.com/gpu requests and node capacity |
Node prices
The pricing engine (pricingEngine.enabled, on by default) answers Quote(cloud, sku, region, lifecycle) from a layered catalog: an in-memory cache, then the cloud's public price list, then a built-in static table — so a quote never fails because a price API is down.
| Cloud | Source | Credentials |
|---|---|---|
| AWS (EKS) | AWS Price List | none |
| Azure (AKS) | Azure Retail Prices API | none |
| GCP (GKE) | Cloud Billing Catalog API | an API key in a Secret: pricingEngine.gcpBillingSecret (key api-key); without it GKE nodes use the static table |
Prices are list prices for the node's SKU, region and lifecycle. Label nodes covered by a commitment with kubehero.io/lifecycle to price them at that lifecycle, or set your exact negotiated rate — which always wins — with an annotation:
kubectl annotate node ip-10-0-12-34.ec2.internal kubehero.io/node-hourly-usd=2.35For nodes that come and go, set it in the node template where your provisioner supports annotations (for example a Karpenter NodePool's template metadata). The kubehero.io/lifecycle override is a label, so managed node pools on AKS, GKE and EKS can set it directly.
List prices, not your bill
Savings Plans, CUDs, reservations and enterprise discounts aren't replayed onto allocations in v0.3. Use node annotations for effective rates, and reconcile totals with your provider's billing export.
Network rates
Internet egress and cross-zone transfer are priced per GB with per-cloud defaults — AWS $0.09 / $0.01, GCP $0.12 / $0.01, Azure $0.087 / $0 — overridable with controlPlane.pricing.netEgressUSDPerGB and netCrossZoneUSDPerGB. See Network.
Platform notes
| EKS | AL2023 and Bottlerocket nodes run cgroup v2 and support the eBPF signals. Amazon Linux 2 nodes use cgroup v1 — eBPF is skipped there. |
| GKE Standard | Container-Optimized OS nodes run cgroup v2. |
| GKE Autopilot | privileged pods aren't allowed: set collector.ebpf.enabled: false. Cost, logs, pprof profiles and events still work. |
| AKS | Ubuntu 22.04+ and Azure Linux nodes run cgroup v2. |
| Windows nodes | not supported by the collector. |
The cloud.* values
The chart's cloud.aws, cloud.gcp and cloud.azure blocks (IRSA / Workload Identity bindings for the control plane) are reserved for account-level integrations. The v0.3 components don't read them — you don't need to configure any cloud identity to run KubeHero.